Description

CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.

Remediation

References

CVE-2011-4203

Related Vulnerabilities

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-29252)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-5834)

WordPress Plugin Postie Multiple Vulnerabilities (1.9.40)

Bootstrap Select Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-20921)

WordPress Plugin Travelpayouts:All Travel Brands in One Place Cross-Site Scripting (0.7.12)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-94 CVE-2011-4203